EUVD-2026-79580
GHSA-f2m8-73jr-98cp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor states unauthenticated network TCP attack with no interaction, so AV:N/AC:L/PR:N/UI:N; availability-only impact sets C:N/I:N/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
AnalysisAI
Unauthenticated remote denial of service in the Siebel CRM Deployment component (Server Infrastructure) of Oracle Siebel CRM affects supported releases 17.0 through 26.7, allowing any attacker with TCP network access to drive the Deployment service into a hang or frequently repeatable crash. Oracle rates the flaw CVSS 7.5 with a fully remote, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N) but availability-only impact (C:N/I:N/A:H), meaning confidentiality and integrity of CRM data are not directly at risk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of Oracle Siebel CRM Deployment, per the vendor-supplied vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a high-exposure but availability-only issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update referenced in the advisory at https://www.oracle.com/security-alerts/cspusep2026.html, which is the vendor-released fix for the Siebel CRM Deployment component; because Oracle CPU advisories map fixes to specific supported version lines, confirm your 17.0-26.7 build receives the corresponding patch bundle rather than assuming a later release is automatically immune. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today